release: Electron and dependency security updates never trigger a release on their own #351

What

The release's commit analysis (.github/workflows/release.yml:83-90) maps !:/BREAKING CHANGE to major, feat to minor, fix|perf|refactor|build|ci to patch, and anything else to none. Dependabot's commits are chore(deps) and chore(deps-dev), so they never bump.

Electron is a devDependency, and it carries Chromium's security fixes. An Electron-only change between releases computes none. v3.4.1 had only chore(deps*) commits since v3.4.0, so it must have been dispatched with an explicit bump=patch. The labs-videowall-config docs note that Electron's Chromium is outside win_updates/winget, so a release is the only way those fixes reach the wall.

Fix

Treat chore(deps)/chore(deps-dev) touching electron (or any runtime dependency) as a patch, or have Dependabot use a fix(deps) prefix for those. At minimum, document that dependency-only releases need bump=patch.

Found while reconstructing the Electron app's decisions as ADRs for the egui port (#346, docs/adr/open-questions.md). Line numbers are from main at 787375b (v3.4.1).